Cryptographic systems and methods that provide authentication, secrecy and integrity for communications between a pair of nodes communicating over an insecure channel are typically based on shared key and public key protocols. Shared key mutual authentication protocols, for example, EAP-PSK (Extensible Authentication Protocol-Pre-Shared Keys) and EAP-PAX (Extensible Authentication protocol-Password Authenticated Exchange), offer benefits that are attractive to many network operators and equipment manufacturers. Such protocols are computationally inexpensive, when compared with functionally similar protocols that use public-key operations such as Diffie-Hellman and RSA. Shared key protocols typically have a lower infrastructural cost when compared with public-key schemes, creating an industry perception of simplicity and lower management costs associated with shared key schemes.
Nevertheless, there is an inherent lack of identity protection, or identity hiding, in today's shared key protocols. Specifically, the receiving end of the negotiation must know in advance what the identity of the initiator is, so that the receiver may locate the appropriate key in a shared key client/user database. For example, in typical shared key protocols, the client end of the negotiation must send their identity, in plain-text, very early in the exchange. This lack of identity hiding stems from the inherent properties of known shared key protocols. In contrast, protocols that use public-key methods can arrange for the server to be fully authenticated prior to the client ever sending its identity. Therefore, if an identity-protecting mutual authentication and key agreement is required in a shared key protocol, typically some combination of Diffie-Hellman key agreement and public-key signatures are used instead.
There are a plethora of protocols that provide variations on a basic shared key protocol, but they share the same semantics, and the requirement for the client to identify itself to the server in order for the server to determine the correct key to use for further computations in the protocol. Thus such protocols are subject to both passive and active identity disclosure attacks.
Passive attacks may be prevented by wrapping the protocol with a Diffie-Hellman based key exchange and encrypting the protocol exchange using the resulting key, but doing so removes the computational efficiency of shared key protocols, and does not address active identity disclosure attacks that use man-in-the-middle (MITM) attack scenarios. To provide protection against active disclosure attacks, the server at least must identify itself in a verifiable way, using public-key signatures (typically RSA or DSA) with cryptographically fresh data. This increases the computational burden on the part of the server.
Accordingly, there is a need for a system and method that can allow a client and server to agree on a shared key, which protects the client identity in a more computationally efficient manner, and avoids the above mentioned problems.